Black-box 3D Face Reconstruction Attack on Face Recognition from a Single Image

3D face recognition systems are frequently susceptible to spoofing attacks, with 3D face presentation attacks being particularly notorious. Attackers commonly exploit 3D scanning and printing techniques to generate masks of target individuals, a method proven successful in various real-world scenarios. A defining characteristic of these attacks involves acquiring 3D face models via 3D scanning, a process that is notably more expensive and cumbersome compared to obtaining 2D photos. In this work, we introduce DREAM, a novel method for recovering 3D face models from a single 2D image. Specifically, our approach adopts a black-box strategy, reconstructing sufficient depth information to compromise target recognition models—such as face identification and authentication systems—by merely accessing their output and the corresponding RGB photo. Our key insight is that achieving successful attacks doesn’t necessitate restoring the precise ground-truth depth values; instead, it only requires recovering the essential features that are salient to the target model’s decision-making process. We evaluate DREAM’s effectiveness using four public 3D face datasets. Experimental results indicate that DREAM achieves a 94% success rate on face authentication models, even in cross-dataset testing. For face identification models, the success rate is 36%. Building upon DREAM, we further propose DREAM-3D, which leverages a 3D GAN to reconstruct depth images for deceiving 3D face recognition systems. Additionally, we evaluate DREAM-3D’s effectiveness on two datastes. Experimental results indicate that DREAM-3D achieves attack success rates exceeding 90% and approximately 50% against different models.